{"id":"CVE-2026-123803","kind":"vulnerability","aliases":["CVE-2026-123803"],"related":[],"title":"SuperTokens Core: passkey login lets users sign into other tenants","description":"SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","summary":"SuperTokens Core, an open source authentication server, fails to limit WebAuthn passkey lookups and sign-ins to the requested tenant. A user with a valid passkey in one tenant can sign in to another tenant of the same application without being a member there.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","runtime","self-hosted","supertokens-core","webauthn"],"not_affected_if":["no-webauthn","patched-version","single-tenant"],"how_to_check":"- Confirm the deployed SuperTokens Core version is between `10.1.0` and the fixed release for its branch.\n- Check whether the application runs several tenants that share one user pool and uses WebAuthn passkey sign-in.","fix":"- Upgrade to `11.0.9`, `11.1.4`, `11.2.4`, `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, or `12.3.1`, matching the release branch in use.","status":"open","published_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:29:41+00:00","updated_at":"2026-11-09T19:29:41+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T19:29:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `11.0.9`, `11.1.4`, `11.2.4`, `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, or `12.3.1`, matching the release branch in use.","reach":"internet","title":"SuperTokens Core: passkey login lets users sign into other tenants","impact":"high","summary":"SuperTokens Core, an open source authentication server, fails to limit WebAuthn passkey lookups and sign-ins to the requested tenant. A user with a valid passkey in one tenant can sign in to another tenant of the same application without being a member there.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["supertokens-core","self-hosted","multi-tenant","webauthn"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"ordinary user signs into another tenant without membership","analyst_note":"","how_to_check":"- Confirm the deployed SuperTokens Core version is between `10.1.0` and the fixed release for its branch.\n- Check whether the application runs several tenants that share one user pool and uses WebAuthn passkey sign-in.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-tenant","no-webauthn","patched-version"],"who_is_affected":"Teams that run SuperTokens Core in a multi-tenant setup, with WebAuthn passkeys enabled and tenants sharing one user pool, are exposed. Single-tenant deployments, or deployments that do not use WebAuthn, are not affected by the cross-tenant sign-in path described in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001393,"input_tokens":4924,"output_tokens":1801,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123803':13A,16A '-2026':12A,15A '10.1.0':81C '11.0.9':83C,177C '11.1.4':84C,178C '11.2.4':85C,179C '11.3.8':86C,180C '11.4.8':87C,181C '12.0.11':88C,182C '12.1.2':89C,183C '12.2.1':90C,184C '12.3.1':92C,186C 'anoth':62B,148C 'applic':67B,100C,158C 'application-scop':99C 'assert':146C 'authent':33B,78C,161C 'constrain':105C 'core':2A,26B,29B,73C 'cve':11A,14A 'deploy':123C 'despit':163C 'endpoint':154C 'fail':35B 'fix':174C 'getuserinfobycredentialid':96C 'host':23B 'in':44B 'issu':172C 'let':5A 'limit':37B 'loadoptionsbyid':93C 'login':4A 'lookup':40B,103C 'member':71B 'membership':117C,166C 'multi':18B,121C 'multi-ten':17B,120C 'one':56B,141C 'open':31B,76C 'ordinari':132C 'passkey':3A,39B,54B,139C 'perform':98C 'pool':130C 'possess':135C 'request':47B,109C 'runtim':20B 'scope':101C 'self':22B 'self-host':21B 'server':34B,79C 'share':128C 'sign':7A,43B,59B,152C 'sign-in':42B,151C 'sourc':32B,77C 'submit':144C 'supertoken':1A,25B,28B,72C 'supertokens-cor':24B 'target':169C 'tenant':10A,19B,48B,57B,63B,110C,116C,122C,142C,149C,170C 'transact':94C,97C 'use':124C 'user':6A,50B,129C,133C 'valid':53B,138C 'verifi':115C 'version':176C 'webauthn':27B,38B,102C,125C 'webauthn.signin':112C 'without':68B,104C","nicknames":[],"mitigations":[],"who_affected":"Teams that run SuperTokens Core in a multi-tenant setup, with WebAuthn passkeys enabled and tenants sharing one user pool, are exposed. Single-tenant deployments, or deployments that do not use WebAuthn, are not affected by the cross-tenant sign-in path described in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","multitenant","runtime","selfhosted","supertokenscore","webauthn"],"campaign_type":null,"search_a":"'-123803':13A,16A '-2026':12A,15A 'core':2A 'cve':11A,14A 'let':5A 'login':4A 'passkey':3A 'sign':7A 'supertoken':1A 'tenant':10A 'user':6A","search_b":"'anoth':62B 'applic':67B 'authent':33B 'core':26B,29B 'fail':35B 'host':23B 'in':44B 'limit':37B 'lookup':40B 'member':71B 'multi':18B 'multi-ten':17B 'one':56B 'open':31B 'passkey':39B,54B 'request':47B 'runtim':20B 'self':22B 'self-host':21B 'server':34B 'sign':43B,59B 'sign-in':42B 'sourc':32B 'supertoken':25B,28B 'supertokens-cor':24B 'tenant':19B,48B,57B,63B 'user':50B 'valid':53B 'webauthn':27B,38B 'without':68B","search_c":"'10.1.0':81C '11.0.9':83C,177C '11.1.4':84C,178C '11.2.4':85C,179C '11.3.8':86C,180C '11.4.8':87C,181C '12.0.11':88C,182C '12.1.2':89C,183C '12.2.1':90C,184C '12.3.1':92C,186C 'anoth':148C 'applic':100C,158C 'application-scop':99C 'assert':146C 'authent':78C,161C 'constrain':105C 'core':73C 'deploy':123C 'despit':163C 'endpoint':154C 'fix':174C 'getuserinfobycredentialid':96C 'issu':172C 'loadoptionsbyid':93C 'lookup':103C 'membership':117C,166C 'multi':121C 'multi-ten':120C 'one':141C 'open':76C 'ordinari':132C 'passkey':139C 'perform':98C 'pool':130C 'possess':135C 'request':109C 'scope':101C 'server':79C 'share':128C 'sign':152C 'sign-in':151C 'sourc':77C 'submit':144C 'supertoken':72C 'target':169C 'tenant':110C,116C,122C,142C,149C,170C 'transact':94C,97C 'use':124C 'user':129C,133C 'valid':138C 'verifi':115C 'version':176C 'webauthn':102C,125C 'webauthn.signin':112C 'without':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123803","severity":null,"published_at":"2026-11-09T19:16:47+00:00","modified_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[{"id":109154,"url":"https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109155,"url":"https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109156,"url":"https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109157,"url":"https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109158,"url":"https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109159,"url":"https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109160,"url":"https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109161,"url":"https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109162,"url":"https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109114,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109115,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109116,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}